Bugs reports should be made through the Zope bugtracker at
https://bugs.launchpad.net/zope2. A bug report should contain detailed
information about how to reproduce the bug, error messages (see
/error_log within the ZMI or var/event.log).

Issue #27: Fix publishing of ZPublisher.Iterators.IStreamIterator under
WSGI. This interface does not have seek or tell. Introduce
ZPublisher.Iterators.IUnboundStreamIterator to support publishing
iterators of unknown length under WSGI.

Ensure that the WSGIPublisher begins and ends an interaction
at the request/response barrier. This is required for instance for
the checkPermission call to function without an explicit
interaction parameter.

Ensure that ObjectManager’s get and __getitem__ methods return only
“items” (no attributes / methods from the class or from acquisition).
Thanks to Richard Mitchell at Netsight for the report.

Updated to Zope Toolkit 1.0.6.

Removed HTML tags from exception text of Unauthorized exception
because these tags get escaped since CVE-2010-1104 (see 2.13.12) got
fixed.

LP #787541: Fix WSGIPublisher to close requests on abort unconditionally.
Previously an addAfterCommitHook was used, but this is not run on transaction
aborts. Now a Synchronizer is used which unconditionally closes the request
after a transaction is finished.

Fix support for non-public permission attributes in the
browser:view directive so that attributes which are not included in
allowed_interface or allowed_attributes but which have declarations from a
base class’s security info don’t get their security overwritten to be
private.

LP #143755: Also catch TypeError when trying to determine an
indexable value for an object in PluginIndexes.common.UnIndex

LP #143533: Instead of showing “0.0.0.0” as the SERVER_NAME
request variable when no specific listening IP is configured for
the HTTP server, do a socket lookup to show the current server’s
fully qualified name.

Cleaned up the Products.ZCatalog search API’s. The deprecated support for
using <index id>_usage arguments in the request has been removed. Support
for overriding operators via the <index id>_operator syntax has been
limited to the query value for each index and no longer works directly on
the request. The query is now brought into a canonical form before being
passed into the _apply_index method of each index.

Factored out the Products.MailHost package into its own distributions. It
will no longer be included by default in Zope 2.14 but live on as an
independent add-on.

Merged the query plan support from both unimr.catalogqueryplan and
experimental.catalogqueryplan into ZCatalog. On sites with large number of
objects in a catalog (in the 100000+ range) this can significantly speed up
catalog queries. A query plan monitors catalog queries and keeps detailed
statistics about their execution. Currently the plan keeps track of execution
time, result set length and support for the ILimitedResultIndex per index for
each query. It uses this information to devise a better query execution plan
the next time the same query is run. Statistics and the resulting plan are
continuously updated. The plan is per running Zope process and not persisted.
You can inspect the plan using the Query Plan ZMI tab on each catalog
instance. The representation can be put into a Python module and the Zope
process be instructed to load this query plan on startup. The location of the
query plan is specified by providing the dotted name to the query plan
dictionary in an environment variable called ZCATALOGQUERYPLAN.

Various optimizations to indexes _apply_index and the catalog’s search
method inspired by experimental.catalogqueryplan.

Added a new ILimitedResultIndex to Products.PluginIndexes and made most
built-in indexes compatible with it. This allows indexes to consider the
already calculated result set inside their own calculations.

Changed the internals of the DateRangeIndex to always use IITreeSet and do
an inline migration from IISet. Some datum tend to have large number of
documents, for example when using default floor or ceiling dates.

Added a new reporting tab to Products.ZCatalog instances. You can use this
to get an overview of slow catalog queries, as specified by a configurable
threshold value.

Warn when App.ImageFile.ImageFile receives a relative path with no prefix,
and then has to assume the path to be relative to “software home”. This
behaviour is deprecated as packages can be factored out to their own
distribution, making the “software home” relative path meaningless.

No longer create an Extensions folder in the standard instance skeleton.
External methods will become entirely optional in Zope 2.14.

Avoid using the Products.PythonScripts.standard module inside the
database manager ZMI.

Factored out the Products.BTreeFolder2, Products.ExternalMethod,
Products.MIMETools, Products.OFSP, Products.PythonScripts and
Products.StandardCacheManagers packages into their own distributions. They
will no longer be included by default in Zope 2.14 but live on as independent
add-ons.

Factored out the Products.ZSQLMethods into its own distribution. The
distribution also includes the Shared.DC.ZRDB code. The Zope2 distribution
no longer includes the code automatically. Please depend on the new
distribution yourself, if you use the functionality. To make the transition
easier this change has been backported to Zope 2.12.9, so you can depend on
the new distribution already in packages requiring at least that version of
Zope 2.

Made both Shared and Shared.DC namespace packages.

Removed fallback code for old Python versions from
ZServer.FTPServer.zope_ftp_channel.push.

Removed fallback code for old ZCatalog.catalog_object function signatures
from Products.ZCatalog.ZCatalog.reindexIndex.

Added a new API get_packages_to_initialize to OFS.metaconfigure.
This replaces any direct access to Products._packages_to_initialize.
The OFS.Application.install_package function takes care of removing entries
from this list now.

Added notification of IDatabaseOpenedWithRoot.

Added a new API’s get_registered_packages, set_registered_packages to
OFS.metaconfigure which replace any direct access to
Products._registered_packages.

Changed product install so it won’t write persistent changes only to abort
them. Instead we don’t make any database changes in the first place.

Moved AccessControl, DocumentTemplate (incl. TreeDisplay) and
Products.ZCTextIndex to their own distributions. This removes the last direct
C extensions from the Zope2 distribution.

Moved the zExceptions package into its own distribution.

Drop the dependency on the ThreadLock distribution, by using Python’s thread
module instead.

Integrated the Products.signalstack / z3c.deadlockdebugger packages. You can
now send a SIGUSR1 signal to a Zope process and get a stack trace of all
threads printed out on the console. This works even if all threads are stuck.

Changed the default for enable-product-installation to off. This matches
the default behavior of buildout installs via plone.recipe.zope2instance.
Disabling the persistent product installation also disabled the ZMI help
system.

Removed Zope2’s own mkzeoinstance script. If you want to set up ZEO instances
please install the zope.mkzeoinstance and use its script.

Removed deprecated read-only-database option from zope.conf.

LP #143232: Added option to ‘zope.conf’ to specify an additional directory to
be searched for ‘App.Extensions’ lookups. Thanks to Rodrigo Senra for the
patch.

Finished the move of five.formlib to an extra package and removed it from Zope
2 itself. Upgrade notes have been added to the news section of the release
notes.

ZPublisher: Removed ‘Main’ and ‘Zope’ wrappers for Test.publish. If anybody
really used them, he can easily use ZPublisher.test instead. In the long run
ZPublisher.test and ZPublisher.Test might also be removed.

Completely refactored ZPublisher.WSGIResponse in order to provide
non-broken support for running Zope under arbitrary WSGI servers. In this
(alternate) scenario, transaction handling, request retry, error handling,
etc. are removed from the publisher, and become the responsibility of
middleware.

Moved the code handling ZCML loading into the Zope2.App package. The
component architecture is now setup before the application object is created
or any database connections are opened. So far the CA was setup somewhat
randomly in the startup process, when the Five product was initialized.

Moved Products.Sessions APIs from SessionInterfaces to interfaces,
leaving behind the old module / names for backward compatibility.

Updated copyright and license information to conform with repository policy.

LP #143410: Removed unnecessary color definition in ZMI CSS.

LP #374810: __bobo_traverse__ implementation can raise
ZPublisher.interfaces.UseTraversalDefault to indicate that there is no
special casing for the given name and that standard traversal logic should
be applied.

LP #142464: Make undo log easier to read. Thanks to Toby Dickinson for the
patch.

LP #142401: Added a link in the ZMI tree pane to make the tree state
persistent. Thanks to Lalo Martins for the patch.

LP #142502: Added a knob to the Debug control panel for resetting profile
data. Thanks to Vladimir Patukhov for the patch.